A coalition of leading digital privacy advocates has penned a joint letter to the European Data Protection Board (EDPB) ahead of its pending decision on Meta’s ad-free subscription option, urging the bloc’s privacy regulators to oppose the scheme before it becomes common among other service providers.
28 organizations including noyb (headed by privacy activist Max Schrems), the Irish Council for Civil Liberties, Wikimedia Europe, and the Electronic Privacy Information Centre have signed on to the argument that “pay or OK” would be adopted by every online service that is currently ad-supported if it is given the greenlight. That would mean exorbitant costs to consumers to protect their privacy, essentially rendering the General Data Protection Regulation (GDPR) toothless as businesses could force those who do not pay to either accept their tracking terms or stop using the service entirely.
Decision by privacy regulators could reshape the EU data protection landscape
Meta implemented the “pay or OK” ad-free system after running through every legal possibility for evading user consent for ad tracking. This saga played out from the implementation of the GDPR’s full terms in 2018 through most of 2023, with privacy regulators and the EU courts repeatedly rejecting the company’s attempts to use measures like “contractual necessity” and “legitimate interest” as exceptions to GDPR consent requirements.
Meta’s latest scheme essentially requires users to pay a minimum of 9.99 euros per month to not have personal data collected while using the services, something it touts as an “ad-free” experience. There are no other options for opting out of tracking, however, so users of its services (such as Facebook and Instagram) must either consent to an extensive measure of profiling for personalized advertising or pay for privacy. The only other alternative is to stop using these services altogether.
The coalition suggests that if privacy regulators sign off on this ad-free scheme, it will immediately be adopted by every other service that monetizes via personalized advertising. That could undo a great deal of the work GDPR decisions have done to improve user privacy online over the last few years, with the letter suggesting it would be a complete victory for “surveillance capitalism.”
The courts and privacy regulators have signaled that ad-free “pay or OK” systems are within the bounds of the GDPR, but with numerous caveats and restrictions. The Court of Justice of the European Union (CJEU) gave the model the strongest endorsement it has received yet in July of last year, saying that it “could be” valid if an “appropriate fee” is charged. This definition was echoed by the Austrian data protection agency, and noyb has already issued a separate legal challenge there on the basis of disparity in revenue (Meta’s requested subscription fee is much higher than what it is estimated to make off the average user per month from targeted advertising).
A legal battle is brewing, however, as other privacy regulators disagree with this interpretation entirely. A binding decision issued by the EDPB in November rejected the CJEU interpretation and agreed with Schrems’ price challenge should an “appropriate fee” for an ad-free alternative be accepted. France’s CNIL has also agreed on this point, noting that users do not have a “real alternative” to tracking if the subscription cost is not “reasonable.” Given the numbers being thrown around in these statements, it would appear Meta would have to cut its asking price by at least 50% for regulators to take a favorable view of the situation.
Ad-free decision could land anywhere from price regulation to fundamental rights
The lead privacy regulators of the Netherlands, Norway, and Hamburg have requested that the EDPB issue guidance on Meta’s “pay or OK” plan, something that is expected in a matter of weeks. Such guidance would not put an end to the issue, with existing GDPR complaints pending among other elements, but it could prompt other services to immediately implement similar ad-free schemes if the decision ends up being in Meta’s favor.
There is another direction that this case could take that ranges beyond the limits of the existing GDPR terms. Schrems has already advanced the argument that data privacy is a fundamental right that cannot be subject to a fee, something that is backed up by language in the Charter of Fundamental Rights of the European Union. An inequality argument could be advanced that casts this right to privacy as being only accessible to people with enough financial means, leaving everyone else out in the cold.
However, given the EDPB’s previous takes on the issue, ad-free plans will likely run into GDPR trouble before anything else. The scheme clashes with language in the regulation that specifies informed consent must be “freely given,” something that is highly debatable if the only alternative is to pay or get off the platform.
